CVE-2026-71256: nanoMODBUS Buffer Overflow Vulnerability

CVE-2026-71256 Overview

CVE-2026-71256 is an out-of-bounds stack read that escalates to a wild-pointer write in the nanoMODBUS client library through version v1.23.0. The flaw resides in nmbs_read_device_identification_basic() and recv_read_device_identification_res() inside nanomodbus.c. A malicious Modbus server can send a Read Device Identification response containing an attacker-controlled object_id byte. The client indexes a 3-element stack array with this value without any bounds check, then uses the resulting stale stack byte as an index into a pointer array. The corrupted pointer is passed to strncpy() as the destination, giving the server an arbitrary-address write with server-controlled data.

Critical Impact
A remote Modbus server can achieve arbitrary memory write on the client, enabling remote code execution against industrial and embedded systems that link nanoMODBUS.

Affected Products

nanoMODBUS through v1.23.0
Client applications calling nmbs_read_device_identification_basic()
Embedded and industrial control systems linking the vulnerable library

Discovery Timeline

2026-08-05 - CVE-2026-71256 published to the National Vulnerability Database (NVD)
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71256

Vulnerability Analysis

The vulnerability is triggered when a nanoMODBUS client parses a Read Device Identification response from a remote server. Inside recv_read_device_identification_res(), the implementation defines a fixed stack array order[3] = {0,1,2} intended to map the three legal Modbus basic object identifiers (VendorName, ProductCode, MajorMinorRevision) to indices in a companion buffers[3] array of char* pointers.

The server-supplied object_id field is a single byte read directly from the network, so its value ranges from 0 to 255. The code performs buf_index = order[object_id] with no bounds check. When object_id >= 3, the read walks off the end of order[] and returns whatever byte sits adjacent to it on the stack. That stale byte becomes an unchecked index into buffers[], producing a wild char* pointer that is then handed to strncpy() as the destination while the server controls the source bytes. The result is an arbitrary-address write with attacker-supplied content, classified under [CWE-125] Out-of-Bounds Read.

Root Cause

The root cause is missing input validation on a protocol-supplied index. The code trusts that object_id falls within the 0–2 range defined by the Modbus specification for basic identification objects. No if (object_id >= 3) guard exists before the array lookup, and the second dereference through buffers[order[object_id]] compounds the primary out-of-bounds read into a memory-safety failure.

Attack Vector

Exploitation requires the victim to initiate a Modbus TCP or RTU-over-TCP session against a server the attacker controls, or to be man-in-the-middled on a Modbus link. The attacker responds to a Read Device Identification request with a crafted response frame carrying object_id values of 3 or higher. Because the adjacent stack byte is deterministic within a given build, an attacker who can profile the target binary can predict the wild pointer and steer the strncpy() write to a chosen address, corrupting return addresses, function pointers, or GOT entries to achieve code execution. No authentication, user interaction, or elevated privileges are required.

The vulnerability manifests entirely in the client-side response parser. See the nanoMODBUS source for the affected recv_read_device_identification_res() implementation.

Detection Methods for CVE-2026-71256

Indicators of Compromise

Modbus Read Device Identification response frames containing an object_id byte with a value of 3 or higher
Client processes linking nanoMODBUS that crash, segfault, or exhibit heap or stack corruption shortly after establishing a Modbus session
Outbound Modbus TCP connections (typically TCP/502) to untrusted or newly observed server IP addresses

Detection Strategies

Inspect Modbus TCP traffic with a deep packet inspection engine or network intrusion detection system rule that flags function code 0x2B / MEI type 0x0E responses with out-of-range object identifiers.
Perform a software composition analysis scan against firmware images and container builds to identify embedded copies of nanoMODBUS at or below v1.23.0.
Add a compile-time or static analysis rule that flags array indexing by network-derived bytes without preceding bounds checks in Modbus parsers.

Monitoring Recommendations

Log all Modbus client sessions with source and destination addresses, function codes, and response sizes, and forward them to a centralized analytics platform.
Alert on unexpected Modbus client crashes, core dumps, or watchdog restarts on operational technology (OT) endpoints.
Monitor for anomalous outbound connections from human-machine interfaces (HMIs), engineering workstations, or gateways that normally speak only to a fixed list of Modbus servers.

How to Mitigate CVE-2026-71256

Immediate Actions Required

Inventory all applications, firmware images, and containers that embed nanoMODBUS and identify those at or below v1.23.0.
Restrict outbound Modbus TCP traffic from clients so they can reach only known, trusted server endpoints.
Segment OT networks so that Modbus clients cannot be reached by or reach arbitrary hosts on corporate or internet-facing segments.

Patch Information

At the time of publication, the maintainer had not tagged a fixed release. Users should track the nanoMODBUS repository for a version above v1.23.0 that adds bounds validation on object_id in recv_read_device_identification_res(). Consumers who cannot wait can apply a local patch that rejects any Read Device Identification response with object_id >= 3 before the order[] lookup and rebuild dependent binaries.

Workarounds

Disable calls to nmbs_read_device_identification_basic() in client code paths until a patched library is available.
Enforce allowlists on the Modbus servers each client is permitted to contact, using firewall rules or an OT-aware gateway.
Terminate Modbus TCP through a broker or proxy that validates response frames and drops sessions containing malformed device identification objects.

bash

# Example iptables rule restricting a Modbus client to a single trusted server
iptables -A OUTPUT -p tcp --dport 502 -d 10.10.20.5 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 502 -j DROP